9.4 Protected Units and Protected Objects

A
protected object provides coordinated access to shared data, through
calls on its visible protected operations, which can be protected
subprograms or protected entries. A
protected unit is declared by a protected declaration,
which has a corresponding protected_body.
A protected declaration may be a protected_type_declaration,
in which case it declares a named protected type; alternatively, it may
be a single_protected_declaration,
in which case it defines an anonymous protected type, as well as declaring
a named protected object of that type.

For a protected declaration with an interface_list,
the protected type inherits user-defined primitive subprograms from each
progenitor type (see 3.9.4), in the same
way that a derived type inherits user-defined primitive subprograms from
its progenitor types (see 3.4). If the first
parameter of a primitive inherited subprogram is of the protected type
or an access parameter designating the protected type, and there is a
protected_operation_declaration
for a protected subprogram or single entry with the same identifier within
the protected declaration, whose profile is type conformant with the
prefixed view profile of the inherited subprogram, the inherited subprogram
is said to be implemented by the conforming protected subprogram
or entry using an implicitly declared nonabstract subprogram which has
the same profile as the inherited subprogram and which overrides it.

The prefixed view profile of an explicitly declared
primitive subprogram of a tagged protected type shall not be type conformant
with any protected operation of the protected type, if the subprogram
has the same defining name as the protected operation and the first parameter
of the subprogram is of the protected type or is an access parameter
designating the protected type.

the inherited subprogram is overridden with a primitive
subprogram of the protected type, in which case the overriding subprogram
shall be subtype conformant with the inherited subprogram and not abstract;
or

the inherited subprogram is implemented by a protected
subprogram or single entry of the protected type, in which case its prefixed
view profile shall be subtype conformant with that of the protected subprogram
or entry.

If neither applies, the inherited subprogram shall
be a null procedure. In addition to the places where
Legality Rules normally apply (see 12.3),
these rules also apply in the private part of an instance of a generic
unit.

If an inherited subprogram is implemented by a
protected procedure or an entry, then the first parameter of the inherited
subprogram shall be of mode out or in out, or an access-to-variable
parameter. If an inherited subprogram is implemented by a protected function,
then the first parameter of the inherited subprogram shall be of mode
in, but not an access-to-variable parameter.

The execution resource associated with a protected
object has to be acquired to read or update any components of the protected
object; it can be acquired (as part of a protected action — see
9.5.1) either for concurrent read-only access,
or for exclusive read-write access.

As the first
step of the finalization of a protected object, each call remaining
on any entry queue of the object is removed from its queue and Program_Error
is raised at the place of the corresponding entry_call_statement.

Bounded (Run-Time) Errors

It is a bounded error to call
an entry or subprogram of a protected object after that object is finalized.
If the error is detected, Program_Error is raised. Otherwise, the call
proceeds normally, which may leave a task queued forever.

13 Within the declaration or body of a
protected unit other than in an access_definition,
the name of the protected unit denotes the current instance of the unit
(see 8.6), rather than the first subtype of
the corresponding protected type (and thus the name cannot be used as
a subtype_mark).

14 A selected_component
can be used to denote a discriminant of a protected object (see 4.1.3).
Within a protected unit, the name of a discriminant of the protected
type denotes the corresponding discriminant of the current instance of
the unit.